Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in
Deleted user
0 / 0 points
Next:
badges earned

Your Points Tracker
Challenges
Leaderboard
  • Global
  • Feed

Badge for your thoughts?

You're enrolled in our new beta rewards program. Join our group to get the inside scoop and share your feedback.

Join group
Recognition
Give the gift of kudos
You have 0 kudos available to give
Who do you want to recognize?
Why do you want to recognize them?
Kudos
Great job appreciating your peers!
Check back soon to give more kudos.

Past Kudos Given
No kudos given
You haven't given any kudos yet. Share the love above and you'll see it here.

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

Atlassian Crowd Authentication with FAT client

I received the task to authenticate a FAT client (App that runs on MacOS, not web) over Crowd, from within the internet. However I get authentication errors. I tried with POST /rest/usermanagement/1/session. By providing following in the body:

{ "username": "my_username", "password": "my_password"}

But I always get a authentication denied message.

 

When reading through SSO it seems like authentication is only supported through web security frameworks with session cookies?

 

Is it actually possible to just use the REST API to authenticate a user with username and password? I just need a response, with a success or error message. If yes, what REST url do I need to use, and what headers and body do I need to send?

Thanks,

Chris

 

1 answer

1 accepted

1 vote
Answer accepted
Bruno Vincent Community Leader Oct 28, 2018

Hi @Christopher_Armstrong

Yes, of course it is possible to authenticate a user with a username and password from anything that is able to send HTTP requests to the Crowd server.

Unless you provide more details about the error you get, it's hard to say why authentication does not work in your case. You might have forgotten the validation factors or maybe you sent your request from an unauthorised IP address.

Here is a simple curl command to authenticate a user with Crowd's REST API:

curl -X POST -u "<application_name>:<application_password>" -H "Content-Type: application/json" -H "Accept: application/json" -d "{\"username\": \"<username>\", \"password\":\"<user_password>\", \"validation-factors\": { \"validationFactors\": [{\"name\": \"remote_address\", \"value\":\"<user_client_ip_address>\"}]}}" "http://<crowd.example.com>:8095/crowd/rest/usermanagement/1/session"

Screen Shot 2018-10-28 at 15.46.31.png

Anyway, the problem here is that what you want to do is very bad design from a security perspective. If you send the HTTP request to the Crowd server from the fat client, you will need to include the application name and application password in that request. That means that your fat client - which by nature is not secure - will have those credentials hardcoded somewhere in the code or in a configuration file.

You should instead create an application proxy with a REST endpoint requested by your fat client. That REST endpoint will be considered as an application from Crowd's perspective and will have the responsibility to request the Crowd server by sending its application name and application password.

Hope this helps.

Bruno

Thanks very much for your answer. I'm currently testing and will get back.

Thanks, it's working.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Asked in Jira Service Management

JSM June ask me anything (AMA)

Hello Community members! We’re wrapping up the end of JSM June with an Ask Me Anything (AMA) with the Jira Service Management product team. This is your chance to ask all your ITSM questions to o...

238 views 12 14
View question

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you